A network appliance can be used as part of a network visibility solution to route data packets that are traversing a network to one or more external devices, or “tools.” The external tools, which are attached to egress ports of the network appliance, can be used, for example, for intrusion detection, intrusion prevention, network diagnostics, etc. In some deployments it may be advantageous for such a network appliance to distribute incoming network packets to multiple egress ports of the network appliance. Currently, the distribution of incoming packets in such a network appliance is done automatically, with a user having only indirect, high-level control over which egress ports receive the incoming network packets.
Further, the incoming network packets may include inherent groupings, to which the network appliance is agnostic. Agnosticism of the packet groupings can result in less than optimal network traffic monitoring, intrusion prevention, network communication, etc.